CVE-2018-25205highCWE-89

ASP.NET jVideo Kit 1.0 SQL Injection via query Parameter

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 8.8epss 0.3%

probabilidade de exploração

0.3%top 81% das CVEs

exploração observada

nãonenhuma fonte reporta

ASP.NET jVideo Kit 1.0 contains an SQL injection vulnerability that allows unauthenticated attackers to inject SQL commands through the 'query' parameter in the search functionality. Attackers can submit malicious SQL payloads via GET or POST requests to the /search endpoint to extract sensitive database information using boolean-based blind or error-based techniques.

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

Produtos afetados

Mediasoftpro · ASP.NET jVideo Kit

Referências

https://www.exploit-db.com/exploits/44739 https://www.mediasoftpro.com/video-sharing-script/mvc/https://www.vulncheck.com/advisories/asp-net-jvideo-kit-sql-injection-via-query-parameter